AWS S3 bucket NodeJS

Question

hi

I have a SAAS (MERN Stack) application that allows users to upload their documents to AWS S3. I have made the bucket to be private so that the files are not publicly accessible. In this SAAS application, I have about 100 users and they are required to log in to upload and view their documents.

I have heard about using signed URL, using VPC endpoints or IP addresses, or using CloudFront. The question is how do I allow the users to view or upload their documents only after they are logged in, and which methods to use? Many thanks in advance.

Bobby · Answer

Hi there, When dealing with private objects in an AWS S3 bucket, the most common way to securely allow users to upload and download documents is through pre-signed URLs. Here’s an overview of how you can implement each option and their use cases: Pre-Signed URLs AWS S3 pre-signed URLs are the standard way to securely provide temporary access to objects in a private S3 bucket. They work by appending a query string to the standard S3 URL, containing a signature and expiration time. For Uploads: Your server-side application (Node.js backend) generates a pre-signed URL for an S3 PUT operation. The backend sends this URL to the client (front-end application). The user’s browser then directly uploads the file to S3 using this pre-signed URL. For Downloads: When a user requests to download a file, the backend generates a pre-signed URL for an S3 GET operation. This URL is sent to the client. The user’s browser then directly downloads the file from S3 using this pre-signed URL. Here’s a simplified example of how you can generate a pre-signed URL using the AWS SDK for JavaScript in Node.js: const AWS = require('aws-sdk'); const s3 = new AWS.S3({ accessKeyId: 'YOUR_ACCESS_KEY_ID', secretAccessKey: 'YOUR_SECRET_ACCESS_KEY', region: 'YOUR_S3_BUCKET_REGION' }); const bucketName = 'YOUR_BUCKET_NAME'; const objectKey = 'YOUR_OBJECT_KEY'; const expiresInMinutes = 60; // URL will be valid for 60 minutes const params = { Bucket: bucketName, Key: objectKey, Expires: expiresInMinutes * 60 // time in seconds }; // For a PUT operation (upload) const uploadUrl = s3.getSignedUrl('putObject', params); // For a GET operation (download) const downloadUrl = s3.getSignedUrl('getObject', params); Security Note : Never expose your AWS credentials on the client side. Pre-signed URLs should always be generated server-side. VPC Endpoints Using VPC endpoints is generally for when your infrastructure (like EC2 instances or Lambda functions) resides within a VPC and you want to interact with S3 without routing traffic over the public internet. CloudFront with Origin Access Identity (OAI) If you need to serve files over a content delivery network (CDN), AWS CloudFront can be used in conjunction with S3. CloudFront can be configured with an Origin Access Identity (OAI), which is a special CloudFront user that allows CloudFront to fetch files from your S3 bucket. To use CloudFront with OAI: Create an OAI and associate it with your CloudFront distribution. Configure your S3 bucket’s policy to allow access to the OAI. When a user needs to access a file, the backend generates a signed URL or signed cookies for CloudFront instead of S3. Users will access the files via the CloudFront distribution, which caches content at edge locations for lower latency. CloudFront signed URLs/cookies are useful when you need to utilize CDN capabilities, such as caching and faster delivery of content around the world. Conclusion For your use case, pre-signed URLs are probably the most straightforward and appropriate solution, as they allow direct user-to-S3 interaction without the files ever needing to pass through your server, thereby reducing server load and bandwidth usage. CloudFront with OAI is more for speeding up global access to content rather than for upload scenarios. VPC Endpoints are not relevant in the context of a SaaS application with users accessing S3 over the internet. Always follow best security practices, like providing the least privilege needed in IAM policies, regularly rotating AWS credentials, and keeping sensitive information server-side. Best, Bobby

Become a contributor for community

DigitalOcean Documentation

Resources for startups and AI-native businesses

The developer cloud

Start building today

Report this

AWS S3 bucket NodeJS

Related questions

How do I deploy a Node.js app to a DigitalOcean Droplet and keep it running?

What actually happens when you send an email from code - how does SMTP work under the hood?

Presigned URLs vs. Spaces CDN — can I get both private access and edge caching?

What SMTP service are you using for transactional emails on your Droplet?

Why does my Droplet show high CPU usage even when my app is idle?

How to Use Redis for Caching and Session Management in Laravel, Django, and Node.js on Ubuntu 24.04 (Self-Hosted and DigitalOcean Managed Re

Droplet: Docker => laravel (mysql) + astro app [unusable]

docker laravel app with astro frontend

Does node.js server on App Platform 2vCPU server uses all cores of machine?

How to set up wildcard dynamic subdomains with DigitalOcean App Platform?

PostgreSQL on App Platform – Self-Signed Certificate in Certificate Chain issue

how to use digitalocean with a phone (i have no computer)

Report this

AWS S3 bucket NodeJS

Related questions

How do I deploy a Node.js app to a DigitalOcean Droplet and keep it running?

What actually happens when you send an email from code - how does SMTP work under the hood?

Presigned URLs vs. Spaces CDN — can I get both private access and edge caching?

What SMTP service are you using for transactional emails on your Droplet?

Why does my Droplet show high CPU usage even when my app is idle?

How to Use Redis for Caching and Session Management in Laravel, Django, and Node.js on Ubuntu 24.04 (Self-Hosted and DigitalOcean Managed Re

Droplet: Docker => laravel (mysql) + astro app [unusable]

docker laravel app with astro frontend

Does node.js server on App Platform 2vCPU server uses all cores of machine?

How to set up wildcard dynamic subdomains with DigitalOcean App Platform?

PostgreSQL on App Platform – Self-Signed Certificate in Certificate Chain issue

how to use digitalocean with a phone (i have no computer)